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Municipal Affairs is committed to the promotion of management 
excellence in municipal operations. 


This publication has been developed in consultation with 
municipal staff and municipal auditors. We are pleased to 
provide this material to you and hope it will be useful in the 
operation of your municipality. 


Your comments on this publication are encouraged. If you would 
like to give us your thoughts, just fill in the form at the back 
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the area field offices listed on the back cover. Comments on the 
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OVERVIEW 


This is the second of two Management Advisory publications. As 
with the first publication, it is directed to all municipal 
officials, both elected and appointed, and is designed to inform 
and advise them about the purpose and nature of the municipal 
audit function. 


The first publication, entitled "The Municipal Audit- 
Responsibility/Communication" was published in November 1986. As 
the title implies, it dealt with the responsibility and 
communication aspect between the auditor and the client. 


The topics covered in the first publication were: 


. What is an Auditor? 

. Types of Audits 

. Engagement Letters 

. Reporting Requirement 

. Client-Auditor Relationship 
. Scope of Audit 

. Materiality in Auditing 

. Fraud 

. Audit (or Equivalent) Committees 
. Letters of Representation 

. Management Letters 


If you do not already have a copy of the first publication, it 
may be purchased, in person, from the Ontario Government 
Bookstore, 880 Bay Street, Toronto, M5S 1Z8 or, by mail order, 
from Publications Services Section, 5th Floor, 880 Bay Street, 
Toronto, M7A 1N8. (Telephone: 965-6015). 


This publication covers the following topics: 
Chapter 1--Internal Control 


The purpose of this chapter is to describe the basic elements and 
management of internal control. A listing of features for good 
internal control procedures can be found in Appendix A. 


Chapter 2--Internal Auditing 


This chapter will discuss the need for internal auditing and the 
scope and objectives of the internal audit function. It will also 
cover the relationship with the external auditor, his or her 
status within the organization and the benefits of internal 
auditing. 


Chapter 3--Auditor Independence 


External auditors frequently provide bookkeeping/accounting 
services either directly or through related service bureaus or 
bookkeeping organizations. Municipalities also rely to a large 
extent on their auditor to prepare the financial statements and 
sometimes to provide management consulting services. This 
chapter will discuss the need for auditor independence and 
provide guidelines to municipal auditors and municipalities to 
reflect those services where a potential conflict of interest and 
loss of independence could arise. 


Chapter 4--Audit Fees 


This chapter will discuss the criteria for assessing the value of 
the audit conducted and the factors that can help to minimize 
audit fees. Methods of evaluating the appropriateness of audit 
fees and how to resolve audit fees disputes will also be 
discussed. 


Chapter 5--Third Party Liability 


Third party liability is an area in which public accountants are 
particularly vulnerable. A general discussion on the liability 
of a public accountant for a loss suffered by a person other than 
his or her own client is outlined in Appendix B. 
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CHAPTER 1 INTERNAL CONTROL 


Internal control can do much to protect against fraud and assure 
the reliability of accounting data. But it is important to 
recognize the limitations in any system of internal control. 
Errors may be made in the performance of control procedures as a 
result of carelessness, misunderstanding of instructions, or 
other human factors. Those control procedures which depend on 
separation of duties may be circumvented by collusion among 
employees. Since most controls are directed at regularly 
recurring types of transactions, their efficiency may vary with 
the volume of transactions or changes of staff. 


Considerations of cost will limit how much internal control is 
adopted by a municipality. A system of internal control so 
perfect as to make any fraud or error impossible would cost more 
to maintain than warranted by the expected benefits. Particularly 
in a small municipality with only a few employees, it is often 
impracticable to separate completely the custody of assets from 
the function of recordkeeping. Despite these limitations, 
however, many actual defalcations or frauds would have been 
prevented or disclosed at an early stage if even the most simple 
and inexpensive of internal control practices had been followed. 


Definition 


The Canadian Institute of Chartered Accountants Handbook defines 
internal control as comprising "the plan of organization and all 
the co-ordinate systems established by the management of an 
enterprise to assist in achieving management’s objective of 
ensuring, as far as is practical, the orderly and efficient 
conduct of its business, including the safeguarding of assets, 
the reliability of accounting records, and the timely preparation 
of reliable financial information." 


Internal control procedures and measures can be subdivided into 
two general categories: 


Administrative Controls 

These controls are concerned mainly with operational efficiency 
and adherence to prescribed managerial policies. They have only 
an indirect relationship to the accounting and financial records. 


Accounting Controls 
These controls are concerned mainly with safeguarding of assets, 


the recording of liabilities and the reliability of financial 
records. They have a direct relationship to the accounting and 
financial records. 


Objectives 


The system of internal control constitutes all the measures, 
procedures and activities that serve to check or promote the 
proper recording of transactions in the records and books-of- 
account of the municipality, the safeguarding of assets, the 
improvement of operational efficiency and effectiveness, and the 
adherence to prescribed policies and statutory requirements. 
Secondary objectives of internal control would involve procedures 
designed to: 


i) ensure timely preparation of financial information 
for decision-making and monitoring purposes; 


ii) avoid unintentional exposure to risk; 
iii) prevent or detect errors and irregularities; and 


iv) ensure that delegated responsibilities are properly 
discharged. 


The extent and detail of controls designed and implemented to 
accomplish these broad objectives must be based on the degree of 
risk to assets - whether that risk is loss, error or misuse. 
Obviously, the greater the risk, the greater the degree of 
required controls. 


Phases of Internal Control 


The installation of a system of internal control consists of 
three stages or phases: 


(i) design of the system; 


(i7) implementation of specific features or procedures; 
and 


(ii7) evaluation of the effectiveness of the system 
implemented to ascertain whether the controls are 
operating as intended. 


Furthermore, internal control should be considered from the 
perspective of the responsibilities of members of council, 
officers of the municipality and the independent’ external 
auditor. 


The establishment and maintenance of an internal control system 
is a managerial responsibility. The treasurer of the 
municipality should be responsible for the design and 
implementation of the accounting system and hence the internal 
control system which is a component of the accounting system. 
Members of council should, in essence, oversee or monitor the 
performance of the municipality by way of receiving regular 
reports and financial statements. 


Features of Internal Control 


Internal control features are those procedures instituted into 
the accounting system or process to prevent or detect: 


(i) errors that are unintentional; and/or 
(ii) irregularities that are intentional. 


An unintentional error is a mistake. It arises from carelessness 
or a lack of adequate knowledge. 


An intentional error arises from deliberate planning, usually 
involving a dishonest person. Such an act may become the basis 
of legal action. 


Appendix A lists the procedures that are the essential 
characteristics of a good internal control system. However, this 
list is not all-inclusive. An elementary procedure such as 
requiring all records to be kept in ink rather than pencil can be 
considered a form of internal control. It should be noted also in 
this context that the adequacy of internal control is subjective 
and subject to change or re-evaluation due to _ changed 
circumstances or procedures. The system of internal control 
should be considered in degrees of adequacy or inadequacy. 


No system of internal control can be foolproof or perfect. Any 
system can be circumvented by: 


1) carelessness or incompetence on the part of personnel 
whose duties and responsibilities are considered an 


integral part of the internal control; 


is deliberate alteration or manipulation of the 


accounting records to conceal a shortage or other 
irregularity; and 


iii) lack of adequate preventive or detective controls 
such as poor segregation of duties and 
responsibilities that are incompatible. 


An adequate internal control system would probably prevent these 
occurrences or would at least detect them after the fact. It 
should be emphasized, however, that in considering the internal 
controls to be instituted, the cost of the control should not be 
greater than the potential benefit it is expected to achieve. It 
is possible to have too many controls, which result in increased 
staff time in performing the control function and investigating 
errors and/or delays which result in inefficient operations. 


Internal Control for a Small Municipality 


Because internal control is often mistakenly believed as 
demanding an elaborate division of duties, it may be thought that 
a sound system of internal control is not feasible for a small 
municipality. This view does not take into consideration the 
many internal control features which operate independently and 
automatically, or the contribution toward an effective system 
which the treasurer himself can make. 


It would be unreasonable to expect a small municipality to have 
an internal auditor. However, if the basic features of internal 
control are examined, it becomes apparent that most are 
applicable to both large and small municipalities. Even though 
it may not be common to formalize policies in manuals, it is 
certainly possible for a small municipality to have competent, 
trustworthy personnel with clear lines of authority; proper 
procedures for authorization, execution and _ recording of 
transactions; adequate documents, records and reports; physical 


control over assets and records; and, to a limited degree, checks 
on performance. 


In municipalities having only one or two office staff, it will 
obviously not be possible or efficient to segregate accounting 
duties. In such instances, council or a committee of council 
should become more involved in overseeing, reviewing § and 
approving the operations of the treasury department on a day to 
day basis. Such involvement could take the form of periodically 
reviewing and approving a listing of cheque payments, having a 
member of council sign cheques, approve payrolls, purchases, 
payments and review financial statements. 


One major control available in a small municipality is the 
knowledge and concern of the treasurer. A personal interest in 
the municipality and a close relationship with the personnel make 
possible careful evaluation of the competence of the employees 
and the effectiveness of the overall system. For example, the 
system can be significantly strengthened if the treasurer 
conscientiously performs such duties as carefully reviewing 
supporting documents before signing cheques, reviewing bank 
reconciliations, examining tax arrears notices, examining all 
correspondence from ratepayers and suppliers. 


Instances where discrepancies or errors are uncovered should be 
investigated thoroughly and resolved to the satisfaction of 
council or a committee of council. In addition, in instances 
such as these, council should formally require its municipal 
auditor to perform additional detailed checking of the 
transactions recorded in the accounts and to provide a management 
letter indicating areas of significant weaknesses and 
recommendations as to how the weakness could be reduced or 
minimized. 


Role of the External Auditor 


In order for the external auditor to express an opinion on the 
financial statements, he must review and evaluate the adequacy 
and effectiveness of the internal control system. Careless 
financial control, careless management and careless accounting 
make an audit difficult and costly and limit its reliability 
resulting in a qualified opinion. The external auditor would be 
concerned mainly with ensuring that adequate preventive and 
detective controls exist so as to ensure: 


Ci) that the assets and liabilities of the municipality 
are properly accounted for at all times (i.e. assets 
are safeguarded against loss, destruction or 
unauthorized use); and 


(ii) that the accounting system is compiling financial 
information on a timely, valid, complete, accurate 
and reliable basis for use in the stewardship and 
decision-making process. 


It should be noted that the external auditor’s responsibility 
extends beyond just reviewing and evaluating internal control to: 


(i) providing a management letter or letter on internal 
control weaknesses to the treasurer and/or council. 
Such a letter could be made mandatory through the 
engagement letter and is usually prepared by the 
external auditor as a by-product of his attest audit 
engagement to document his findings and 
recommendations; and 


(ii) considering any serious deficiencies in the internal 
control system that may have a material impact on the 
fairness of presentation of financial data in the 


financial statements. An external auditor’ in 
performing an attest audit (i.e., a statutory audit 
requiring an attestation or opinion on the financial 
statements) has to rely on the integrity and 
reliability of the accounting records in that it is 
not possible or economically justifiable for him to 
audit all records and documents. An adequate system 
of internal control enables an auditor to limit his 
audit testing without impairing the quality or 
coverage of his examination. 


The external auditor, on the basis of his evaluation of the 
system of internal control may provide assistance and advice on 
these matters. Municipal officials should confer with the 
external auditor on an on-going basis as to : 


(i) what areas of internal control are weak or deficient 
and require improvement; 


(ii) what feasible internal control features or procedures 
could be implemented to reduce or eliminate the 
weakness, given the constraints or circumstances 
existing in the municipality’s operations; 


(i117) how any changes in internal control procedures would 
be implemented, taking into consideration the limited 
staff size and the need to ensure proper division of 
duties; and 


(iv) the manner in which the proposed changes would be 
monitored and evaluated for any unforeseen problems 
or weaknesses. 


Council and municipal officials should make it a practice to 
consult the external auditor whenever they encounter any problems 


or changes in circumstances that relate directly to the 
accounting and control systems. However, this would occur only 
if they cannot resolve the problems by themselves, otherwise, the 
auditor’s charges would get costly. Changes in staff, rotation of 
duties, additional accounting procedures or reporting 
requirements, elimination or curtailment of certain accounting 
practices and/or any changes in the frequency of performing 
certain functions should be discussed with the _ auditor 
beforehand. 


Ideally, council or delegated municipal officials should co- 
ordinate all their activities pertaining to the design of, and 
changes in, the internal control system with the _ external 
auditor. This could be done each year when the auditor has 
completed his interim audit and submitted his management letter. 


Internal Auditing - Its Relationship to Internal Control 


Another basic component of a strong internal control is an 
internal auditing staff. Internal auditors investigate and 
appraise the system of internal control and the efficiency with 
which the various departments of the municipality are performing 
their assigned functions; they report their findings and make 
recommendations to top management. Please refer to chapter 2 on 
Internal Auditing. 


Summary 


To put this chapter into perspective, the following should be 
emphasized: 


Management Responsibility 
Management, not the auditor, must set up and monitor the 


municipality’s internal control system. This concept is 


consistent with the requirement that management is responsible 
for the preparation of financial statements in accordance with 
generally accepted accounting principles. 


The basic objective of orderly management is the plan of 
organization. This is vital and cannot be overemphasized. A 
system alone is not enough as it is influenced by the relation of 
costs and benefits and the unpredictability of human behaviour. 
The plan of organization as defined on page 1 of this chapter 
needs constant review to adjust for changed circumstances and to 
guard against the cumulative effect of small changes made with 
inadequate consideration. 


Reasonable Assurance 

A municipality should develop an internal control system that 
provides reasonable assurance that the financial statements are 
fairly stated. Internal control systems are developed by 
management after considering both the costs and benefits of the 
controls. Management is often unwilling to implement an ideal 
system because the costs may be too high. For example, it is 
unreasonable for auditors to expect management of a= small 
municipality to hire several additional accounting personnel to 
bring about a small improvement in the reliability of accounting 
data. It is often less expensive to have auditors do more 
extensive auditing than to incur higher internal control costs. 
If auditors find material errors, the scope of the audit can be 
adjusted to compensate, and recommendations made for improvements 
in the system. 


Fidelity Bonds 

A strong internal control is not a guarantee against losses from 
dishonest employees. Neither is it possible to prevent fraud by 
emphasizing the selection of trustworthy employees. Some of the 
biggest embezzlements have been carried out by the most trusted 
employees. The fact that they are so highly trusted explains why 
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they have access to cash, securities and records and are in a 
position that makes embezzlement possible. 


Fidelity bonds are a form of insurance in which a bonding company 
agrees to reimburse the employer, within limits, for losses 
attributable to theft or embezzlement by bonded employees. Most 
employers require employees handling cash or other negotiable 
assets to be bonded. 


Fidelity bonds should not be considered a substitute for internal 
control. If internal control is weak, losses may accumulate 
undiscovered until they exceed the fidelity coverage. Theft or 
defalcation must be discovered and the loss proved before 
recovery can be obtained from a bonding company. 
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CHAPTER 2 INTERNAL AUDITING 


Internal auditing is defined in "The Practice of Modern Internal 
Auditing" by L. B. Sawyer as: 


An independent appraisal of the diverse operations 
and controls within an organization to determine 
whether acceptable policies and procedures are 
followed, established standards are met, resources 
are used efficiently and economically, and the 
organization’s objectives are being achieved. 


The term "internal" emphasizes that the audit is conducted by 
employees within the municipality. This distinguishes it from 
auditing conducted by outside public accountants or external 
auditors or any other parties not directly a part of the 
particular municipality. 


Need for Internal Auditing 


There is a need to know whether municipal funds are handled 
properly and in compliance with existing laws and regulations. In 
addition, it should be determined whether these municipal 
services are being provided efficiently and economically. This 
information, therefore, should be provided by someone who is 
independent and not part of the program development and delivery 
system. 


Because internal auditors are experts on control, their insight, 
directed at management (including council), can assist in 


accomplishing stated objectives by recommending change. 


The internal auditing department is an integral part of the 
municipality and functions under the policies established by 
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management. The statement of purpose, authority and 
responsibility for the internal auditing department, approved by 
department heads and accepted by council, should be consistent 
with those Standards for the Professional Practice of Internal 
Auditing established by the Institute of Internal Auditors. 


Objective 


The objective is to assist all members of management in the 
effective discharge of their responsibilities and consists of 
four aspects: 


assurance; 

discussion of the facts; 
timely reporting; and 
change. 


Assurance 

Assurance means that control processes are satisfactory or that 
improvements are necessary; findings should be supported by a 
description of the work carried out in arriving at conclusions 
and should include an assessment of the risks involved where 
weaknesses are found. 


Discussion of the Facts 

There should be discussion and agreement with management on the 
facts leading to the conclusion or opinion. This should result 
in some reasonable course of action to cure any weaknesses. 


Timely Reporting 
There should be timely reporting of information to management 


concerning potential control problems or issues. Examples might 
include: recommendations made and not implemented; policies or 
directives which are no longer viable; comments of department 
heads concerning actions taken or their view of the weakness; 
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the reliability of information provided through management’s 
reporting process and new systems and information relating to 
safety or security. 


Change 
The internal auditor can recommend changes to correct any 


weaknesses. The auditor’s relationships with those being 
audited, the way in which his report is expressed and his 
credibility and reputation increase the likelihood that the 
audit process will lead to constructive change. 


Scope 
The scope of internal auditing includes: 


reviewing the reliability and integrity of financial and 
operating information and the means used to identify, 
measure, classify and report such information; 


reviewing the systems established to ensure compliance 
with those policies, plans, procedures, Jaws and 
regulations which could have a significant impact on 
operations and reports, and determining whether the 
municipality is in compliance; 


reviewing the means of safeguarding assets and, as 
appropriate, verifying the existence of such assets; 


appraising the economy and efficiency with which resources 
are employed; and 


reviewing operations or programs to ascertain whether 
results are consistent with established objectives and 
goals and whether the operations or programs are being 
carried out as planned. 
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Internal versus External Auditing 


The internal auditor and the external auditor share many common 
interests, and many of the techniques they employ are essentially 


the same. 


A better understanding of their relationship to the 


municipality can be obtained by comparing the differences in 
objectives, responsibilities, scope of activities and procedures 


between these two professional groups. 


Internal Auditing 


The principal objective of the 
invernal auditor is “to aid 
management in achieving 


efficiency, effectiveness and 


economy. 

As an employee of the 
municipality, the internal 
auditor can never be 
completely independent of 
management, but his value to 
management lies in his 
independent position § within 


the municipality, which allows 
him to have an_ objective 


outlook. 


External Auditing 


The principal objective of the 
external auditor is to report 
to the council, inhabitants 
and ratepayers on the overall 
fairness of the municipality’s 


financial statements. 


The external auditor is not an 
employee and is_ completely 
independent of the management 
in that he reports to the 
council, inhabitants and 


ratepayers. 
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Internal Auditing 


of the internal 


activity is 


The scope 
auditor’s 
determined by council as well 
as by the department heads. 
The review and appraisal of 
the internal control system is 
normally the primary concern. 
The deterrence of _— fraud 
remains the responsibility of 
management. Internal auditors 
are responsible for examining 
and evaluating the adequacy 
and effectiveness of actions 
taken by management to fulfil] 
this obligation. 


The internal auditor exercises 
a reasonable amount of freedom 
in methods and_ procedures 


suitable to accomplish his 


goals. In’ *themedarea "of 
financial auditing, the 
internal auditor adopts 
generally accepted auditing 


standards. He may make these 
decisions in concert’ with 
management. The internal 
auditor’s review of _— the 
municipality’s activities is 


continuous. 


External Auditin 


The external auditor examines 
only those activities 
necessary to allow him to form 
an opinion of the 
municipality’s financial 
position. The ~—_ external 
auditor may test and review 
internal controls to determine 
the extent to which he can 
rely on. them. He is only 
incidentally concerned with 
the detection of fraud unless 
such fraud directly involves 
the fairness of the financial 


statements. 


The external auditor must 
follow 


auditing standards in order to 


generally accepted 
report that the municipality’s 
financial statements are 
prepared in accordance with 


generally accepted accounting 


principles. The external 
auditor’s examination 1s 
periodic. 
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Relationship with External Auditor 


Cooperation and coordination between the external and_ the 
internal auditor are essential in order to avoid duplication and 
reduce the overall costs of both types of audits. For the 
external and internal auditor to complement one another in their 
work there must first be a free exchange of ideas. This is 
something that will not. occur until there is a mutual respect of 
each group’s objectives and responsibilities and a _ thorough 
understanding of each group’s audit coverage. 


A fully functioning internal auditing department can ease the 
work of the external auditor by recommending improvements in 
internal controls throughout the municipality. The internal 
auditor can be an important source of information and education 
by providing an orientation program for the external auditor. 
Also, the internal auditor will obviously be the person who 
provides the auditor with his working papers. At the same time 
the external auditor can provide the internal auditor with a 
fresh point of view as to how the work could be done more 
effectively, gained from his experience in auditing other 
municipalities. 


The internal and external auditors should determine between 
themselves in what areas it would be advisable and practical to 
carry out joint audits and what areas must be subject to the 
independent analysis. The final decision as to the scope of the 
external auditor’s work will be determined by the _ external 
auditor alone because of his professional responsibility to 
preserve the independence of his work. However, there may be 
areas where a slight modification of internal auditing procedures 
would make the internal auditing results usable by the external 
auditor, thus eliminating or considerably reducing the work of 
the external auditor in those areas. 
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Section 5215.18 of The Canadian Institute of Chartered 
Accountants Handbook states that the external auditor may rely on 
the internal auditor’s review and testing of the internal control 
system. Where the internal auditor performs a control procedure, 
it would be considered as any other control. The external 
auditor is responsible for verification, which includes reviewing 
and testing the work performed by the internal auditing 
department, since that is part of the municipality’s internal 
control. 


The cooperation between these two groups can _ be mutually 
beneficial provided the internal auditing function is not 
mistakenly viewed as an extension of external auditing and the 
internal auditor not seen as an employee of the external auditor. 


Independence 


A key characteristic of an effective internal audit department is 
the degree of independence with which it operates. Internal 
auditors should be free of organizational pressures that limit 
their objectivity in selecting areas to be examined or in 
evaluating and reporting upon those areas. Internal audit 
independence is strengthened when the auditors are afforded free 
access to and direct channels for reporting findings to council, 
department heads and the audit committee or its equivalent. 


A basic principle of good organization is that no one can be 
expected to evaluate his own work objectively and no one should 
be expected to evaluate the work of the executive to whom he 
reports. Theoretically, an internal auditor cannot be truly 
independent when he reports to the treasurer or the director of 
finance. The dual responsibilities for the operation of an 
important portion of the internal accounting control system and 
for its surveillance by the internal auditors are therefore 
inherently incompatible. The internal auditor’s responsibility 
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for internal control should be to review and advise rather than 
to implement and maintain. 


Determination of the specific executive to whom the internal 
audit department reports depends upon various circumstances. The 
size of the municipality, the organizational structure, the 
number of reporting possibilities and the specific 
responsibilities assigned to each individual executive all play a 
part. The level of work assigned to the department is also a 
consideration. 


Plans for providing the internal audit department with a channel 
of communication to the audit committee deserves consideration in 
determining the reporting level of the department in the 
municipality. Too low a placement may present an awkward 
situation if the head of internal audit needs to bypass a long 
line of superiors to meet the audit committee. 


In view of the need for independence, it is frequently argued 
that the head of internal audit should report directly to council 
or to the audit committee. Failing that, the internal auditor 
should report to the chief administrative officer who has 
substantial authority in a non-financial area and should have 
direct access to council regarding matters that he or _ she 
considers vital. Even when reporting to the chief administrative 
officer is not feasible, the internal auditor must have 
sufficient status to deal with operating managers on an equal, 
not a subordinate, level. Of the municipalities in Ontario with 
internal auditors, approximately two-thirds report to a chief 
administrative officer. 


Objectivity 


The Institute of Internal Auditors Standards for the Professional 
Practice of Internal Auditing defines objectivity as an 
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independent mental attitude which internal auditors. should 
maintain in performing audits. Internal auditors are not to 
subordinate their judgment on audit matters to that of others. 


Role of Internal Auditor 


When a municipality is small, its treasurer is’ intimately 
acquainted with all phases of its operation. However, as the 
municipality grows and its operations grow in complexity, the 
treasurer and other department heads may be unable to maintain 
control. Where this occurs, the internal auditor will cross all 
boundaries to assist management. 


Traditionally, internal auditing was limited to the detection of 
errors and irregularities in financial transactions. The internal 
auditing department was considered a psychological deterrent to 
wrongdoing, and its success was often measured by the number of 
errors and defalcations uncovered. 


The internal auditor or his staff spent hours’ labouriously 
verifying cash on hand, bank deposits, accounts receivable, 
inventories and other assets. He looked strictly for things that 
were wrong, for deviation from corporate policies and procedures, 
and for accuracy of accounting records prepared by bookkeepers 
and others charged with recording transactions. Although the 
internal auditor became thoroughly familiar with many operations 
and could have made valuable suggestions for their improvements, 
he confined his report to revealing disparities in actions 
already taken and mistakes already made. 


As organizations change, so has internal auditing. Computers now 
do most of the bookkeeper’s work and the figures that were 
labouriously ticked off are processed inside the computer. 
Internal auditing is now a managerial approach to reviewing 
operations and controls that requires a different state of mind 
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and a higher order of skills and training on the part of the 
internal auditor. Instead of a negative, protective or clerical 
function, modern internal auditing is now a_ positive, 
constructive and creative service to management. For example, in 
the examination of accounts receivable, the internal auditor 
would in the past have been concerned solely with determining 
whether the receivables were properly recorded. In contrast, 
today’s internal auditor raises a host of questions of managerial 
concern about the overall operation of the accounting department 
and thus expands the financial audit into a much broader 
operational audit. 


Internal Auditing Activities 


Many managers have realized that a tight control system in the 
accounting and financial areas alone is not enough; there is a 
need to know more about operational controls which are made 
increasingly complex by organizational growth and _ computer 
technology. Today, internal auditing activities may extend into 
such areas as delivery of service, personnel, purchasing, 
engineering, compliance with laws and regulations, and conflicts 
of interest of staff and members of council. 


Internal auditing activities fall into two major catagories, 
financial auditing and operational auditing: 


Financial Auditing attempts to verify the existence of assets 
and liabilities and to ascertain that proper safeguards against 
loss, theft or misuse are maintained. 


Operational Auditing involves the extension of internal auditing 


to all operations of a municipality and does not confine itself 
to the financial and accounting areas. 
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Under operational auditing, two areas of potential conflict can 
be avoided if it is remembered that internal auditing is distinct 
from both program evaluation and the responsibilities associated 
with management. Program evaluation is a different and separate 
function which considers the effectiveness of the existing 
program to determine, in the light of present circumstances, its 
adequacy, relevance and the alternatives available. In other 
words, a program evaluator basically questions if a program is 
still needed. An internal auditor, on the other hand, accepts the 
validity of the program and reports to the manager on whether or 
not the manager has adequate control over it. 


It is management’s responsibility to operate programs efficiently 
and economically. Hence, management develops, implements and 
maintains the necessary control systems, such as systems for 
measuring productivity or for reporting progress against plans. 
Auditors aid managers by evaluating control systems and reporting 
on whether they work well. 


Internal auditing is not meant to second-guess management nor is 
it a "witch-hunt" to find errors. Rather, it is meant to be a 
positive tool which managers can use to help ensure the success 
of their programs. 


Audit Procedures 


The auditing of any operation involves a number of distinct 
responsibilities. These normally include familiarization, 
verification, evaluation, compliance, recommendations and follow- 
up. By carrying out these responsibilities the internal auditor 
makes certain that management receives a flow of unbiased 
information indicating the effectiveness of its policies and 
Operations. 
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Familiarization 

The auditor needs to become familiar with the operation’s basic 
objectives, organizational structure, policies and procedures, 
functions, identification of key controls, responsibilities and 
other significant activities through a pre-audit review. The 
standards of performance used by management are important to 
measure the success or failure of a unit in achieving its goals. 
The auditor can gain insight into the potential problems through 
observation and questioning, accompanied by a review of prior 
years’ financial records, operating reports generated by the 
departments and a review of job descriptions. 


Verification 

Verification is attesting to the truth, accuracy and reliability 
of reported data. When protection is the primary focus, the 
auditor examines the accounting records and reports, particularly 
the firm’s assets and liabilities. Verification of assets may 
include the examination of cash, receivables, securities and 
disbursements. Contracts, agreements and leases may be reviewed 
to assure appropriateness of service rendered. Verification 
activities may also include reports on accounts aging, employee 
absences, overtime and accident reports. 


In the financial area, the internal verification activities may 
be closely related to external auditing, which frequently lessens 
the work required of the independent auditor. Furthermore, 
management frequently needs such information on a_ continual 
basis, something the outside auditor is not in a position to 
provide. 


Evaluation 

One of the auditor’s most important responsibilities is the 
evaluation function. This necessitates a very high degree of 
professional judgment. There can be no definite boundary between 
this function and verification, and often the two functions are 
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conducted simultaneously. Without evaluation, verification is 
merely a clerical activity. 


Internal auditors must evaluate the control systems to determine 
if they are adequate and operating as management expects. They 
must also ask if such procedures are still relevant and 
applicable. Are safeguards and security procedures sufficient? 


In addition to evaluating controls, the internal auditors may be 
involved in evaluating departmental performance. The internal 
auditors should refrain from reporting on the performance of 
individual employees unless asked to do so by council. They 
should concentrate on evaluating a particular part of the 
municipality’s success in achieving its objectives by measuring 
results against performance standards. Evaluation of a situation 
elicits less resistance than evaluation of an individual, and 
usually the latter is done only when wrongdoing is suspected. 


Compliance 

Compliance refers to the extent to which policies, plans, rules 
and procedures are followed in actual practice. Often municipal 
policies, procedures, legislation and regulations are not known 
or understood at all management levels. It then becomes the 
internal auditor’s responsibility to ensure that these policies 
and procedures have been properly communicated as well as 
observed or reviewed for change. 


Recommendations 

The internal auditor should not only point out problems but also 
recommend appropriate solutions and commend management on well- 
run operations. Since the internal auditor delves deeply into all 
areas Of operations, he or she can be a continual source of 
suggestions for improvements in efficiency and cost reduction. 
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The fullest potential of internal auditing as a service to 
management lies in this ability to make recommendations based on 
evaluation of operational or financial data. The internal auditor 
should work with management to get agreement on the facts and a 
commitment to correct the deficiency. The auditor must strive to 
make recommendations that are practical, objective, reliable and 
timely. To sum up, the internal auditor must recommend or advise 
on improvements, not develop them, install them or direct them. 


Follow-up 

Since internal auditing is a staff function, the primary 
responsibility for instigating action and following up _ on 
internal auditing recommendations lies with management. Where 
management accepts this primary responsibility and _ provides 
prompt and effective follow-up, operating units realize that 
management strongly supports internal auditing. When management 
follow-up is not prompt and firm, operating units become far more 
lax about correcting deficiencies. 


The follow-up does not mean strict compliance with all audit 
recommendations. The operating managers may disagree with the 
recommendations or may in fact find a better solution for a 
particular problem. These differences must be reconciled, but the 
internal auditor must follow-up to find out whether his 
recommendations have received management’s consideration and to 
make certain that management takes formalized action on them 
within a reasonable length of time. 


Benefits 


An effective internal audit program provides a number of benefits 
to the municipality. The most important, of course, is timely 
advice to the management when weaknesses are found in any of the 
control processes. This advice enables them to take corrective 
action quickly. 
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Because a municipality is so close to its taxpayers (compared to 
provincial and federal governments) one of the important benefits 
of internal auditing is that it can lead to _ increased 
productivity and lower costs. It can also provide management with 
feedback on the functioning of their financial and management 
policies. The audit can identify opportunities for improving such 
policies and can promote understanding of them by those being 
audited. 


Perhaps the greatest advantage of the expanded auditing role will 
be felt by large municipalities where authority is delegated. In 
these situations sound accountability and control systems are 
critical. Therefore, assurances from the audit group on the state 
of these systems is particularly essential. 
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CHAPTER 3 AUDITOR INDEPENDENCE 


In Ontario, municipal auditors frequently provide services, other 

than auditing, to their municipal clients. These services 

include: 

- the preparation of the annual financial statements; 

- advice and assistance in the design and installation of 
bookkeeping and internal control systems; 

- bookkeeping services either directly or indirectly through 
a related service bureau or bookkeeping organization; 

- the interviewing of professional staff; 

- advice and assistance in evaluating and _ installing 
computer systems; and 

- general consulting services either directly or indirectly 
through a separate entity. 


This is similar to the practice in the private sector. There has 
been, and still are, those who question the auditors’ 
independence when performing these additional services for their 
clients. The purpose of this chapter is not to _ identify 
acceptable and unacceptable services provided by the auditing 
firm, since each individual case must be examined separately. 
The following is a discussion to make the reader aware of the 
factors which should be considered. 


What is Auditor Independence ? 


The very purpose and nature of an audit is to obtain the 
independent opinion of the auditor. Independence can be defined 
as the state of not being influenced or controlled by others in 
matters of opinion or conduct; thinking or acting for oneself; 
not subject to another’s authority or jurisdiction; autonomous; 


free. 
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The auditors’ independent opinion that the financial statements 
of the municipality present fairly the financial position and 
operations of the municipality gives the users increased 
confidence in those financial statements. It is the independence 
of the review and report on management’s (including council’s) 
representations on their financial statements as to their 
performance and stewardship that gives rise to the increased 
confidence. 


Legislative Requirements 


Section 88(6) of the Municipal Act states that no person shall be 
appointed as an auditor of a municipality who is or was a member 
of council or any local board of that municipality in the current 
or the preceding year. 


This section of the Act also disqualifies a person as an auditor 
of a municipality who has or had in the preceding year "any 
direct or indirect interest in any contract or any employment 
with the municipality or any of such local boards other than for 
services within his professional capacity." There is no 
definition of "within his professional capacity" provided by the 
Ministry, nor has any court action occurred which would provide a 
definition. 


Rules of Professional Conduct - The Institute of Chartered 
Accountants of Ontario 


The Institute of Chartered Accountants of Ontario "Rules of 
Professional Conduct" state that the auditor "shall hold himself 
free of influence, interest, or relationship which impairs his 
professional judgment or objectivity" or appears to do so to the 
reasonable observer. This statement reflects the two facets of 
independence: independence in fact, and independence’ in 
appearance. 
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CICA Handbook Section 5100.02 - Generally Accepted Auditing 
Standards 


The examination should be performed and the report prepared by a 
person or persons having adequate technical training and 
proficiency in auditing, with due care and an objective state of 
mind. 


Importance of Auditor Independence 


It is evident that there is an "expectation gap" between auditors 
and the public. In other words, there is a difference between 
the assurances the public thinks are provided by an auditor’s 
opinion on the financial statements and what is actually 
provided. There also appears to be a difference in what auditors 
currently provide and what those relying on audit reports want or 
believe they are. getting. The expectation gap thus_ has 
implications for the perception of independence as well as the 
actual fact of remaining independent. 


As a direct result of the failures of the Canadian Commercial 
Bank and the Northland Bank, The Canadian Institute of Chartered 
Accountants has set up a Commission to Study the Expectations of 
Audits, chaired by William Macdonald. 


Auditors need to increase public awareness of what are 
responsibilities and obligations, and, just as important, the 
limitations of an audit. 


The argument has been made that where the auditor provides 
services such as preparation of the financial statements to be 
audited, design and installation of bookkeeping and internal 
control systems, and general consulting, the auditor is no longer 
independent. Without this perceived independence, the auditor 
cannot render a valid audit opinion because there is a conflict 
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of interest. In reality, however, the independent auditor is 
selected and paid by someone affected by the audit. 
Consequently, total independence is a practical impossibility. 
As well, as an auditor establishes a relationship with a client, 
a certain degree of independence is lost due to the personal 
contact between the two parties. While this slight infringement 
on independence would not prevent the auditor from acting in an 
objective manner, it must be recognized that additional contacts 
on a social or civic basis would not enhance the perception of 
the auditors’ independence. Therefore, the practitioner must 
carefully evaluate his relationship with a client and avoid; or 
at least minimize, those circumstances that contribute to the 
perceived loss of independence. 


If total independence is a practical impossibility, how can the 
degree of independence, vital to the audit function, be 
strengthened to provide an acceptable level of assurance of 
independence? 


Suggestions have been made that there could be a segregation of 
audit functions from management consulting functions. That is, 
an auditor might be prohibited from providing both audit and 
management consulting services to the same client. Other 
suggestions include limiting the value of other services to 50 
per cent of the audit fee and/or making it mandatory to disclose 
audit and consulting fees when preparing financial statements. 


Proposals for Strengthening Auditor Independence 
The Cohen Commission in their study entitled "The Commission on 


Auditors’ Responsibilities" considered the following’ three 
proposals in relation to auditor independence: 
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restricting services provided by public accounting firms 
that might be incompatible with the audit function; 


protecting the auditor from management influence; and 


assuring that public accounting firms are managed in a 
manner that provides the necessary internal support for 
the independence of individual partners and staff. 


The Commission’s findings with regard to these three proposals 
are as follows: 


"There is no evidence that provision of services other 
than auditing has actually impaired the independence of 
auditors. However, the belief of a significant minority of 
users that independence is impaired creates a major 
problem for the accounting profession. Decisions on the 
other services offered and used should be made by 
individual public accounting firms and the Council and/or 
audit committee." 


"The present relationship between management and _ the 
auditor needs to be modified substantially to provide more 
support for the auditors’ independence." 


"Management policies of accounting firms - particularly 
those related to pricing and the related pressures on 
staff to reduce time and costs - have a negative effect 
on the ability of auditors to remain independent and 
should be improved." 


"Elements in the business environment such as arbitrary 
time deadlines affect the quality of the audit, place 
unnecessary stress on the auditors’ independence, and 
should be changed." 
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Guidelines for Evaluating Additional Services 


Because the perception of independence is so subjective, there 
can be no hard and fast rules for which particular services might 
result in a loss of independence. The Cohen Commission suggested 
that if two services are performed for the same client and one 
service significantly reduces the usefulness of the other, then 
those services are incompatible. For example, if a public 
accountant provides such extensive management services that the 
distinction, consciously or unconsciously, becomes’ blurred 
between the auditors’ viewpoint and that of management, the 
effectiveness of an independent audit will be lost. If users of 
the auditors’ work believe that there has been a loss of 
objectivity, there may be an unwillingness to rely on the their 
work and again, the effectiveness of the independent audit will 
be lost. 


It would be illogical to say that auditors should be prohibited 
from providing any service other than auditing. The auditor has 
gained specialized knowledge of the client’s operations over a 
number of years. A new consultant would have to document the 
system and become familiar with the problem areas. Thus, the 
cost to the client would be greatly increased by the duplication 
of efforts. It is far more practical for each municipality to 
examine its own unique situation. If they are at least aware that 
there might be a problem, they can make a decision at that point. 
The role and responsibilities of the auditor should be reviewed 
regularly in any case, to ensure that the auditor does have an 
independent environment and is also free from management 
influences and unrealistic deadlines. 


Following is a summary of additional services provided by 


auditors with a brief discussion of the service and its 
implications for the independence of the auditor. 
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1. Design and Installation of Bookkeeping Systems 


The municipal auditor is in an ideal position to provide advice 
and assistance in the design and installation of bookkeeping 
systems through knowledge gained by working with a diverse client 
base. The auditor would also have indepth knowledge of the 
accounting records of an individual client. 


Implication: 

Changes to any system are expected to occur over a period of 
time. It is highly unlikely that the auditor would hesitate to 
suggest subsequent changes during the audit simply because of any 
involvement in the design and implementation of the original 
systems. 


2. Bookkeeping Services 


There are several different types of bookkeeping services which 

may be provided: 

- bookkeeping services as_ record-keeping after’ the 
transaction has taken place; 

- bookkeeping services before the transaction has taken 
place, which form part of the internal control 
procedures; 

- bank reconciliations and other analyses or trial 
balances; 

- preparation and posting of journal entries, and posting 
to the ledgers. 


A number of auditing firms attempt to resolve any perceived 
conflict of interest by providing the bookkeeping services from a 
staff different from the auditing staff, or from a separate 
corporate entity. While this may work, the use of this kind of 
organizational structure would unfairly tend to favour the large 
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firm over the small firm or sole practitioner, which would not 
necessarily relate to the actual maintenance of independence. 


Implication: 

It is unlikely that the auditor’s professionalism would result in 
an error not being corrected if it had been subsequently found as 
part of the audit, particularly when the auditor actually 
prepares the financial statements. 


A recent survey of municipalities combined with direct 
interviews, did not identify the provision of bookkeeping 
services as creating any conflict of interest unless the auditor 
was part of the initiation or approval phases of the transaction. 


3. Design and Installation of Internal Control Systems 


The auditor is obligated to comment on weaknesses in the internal 
control systems observed during the course of the normal audit. 
The provision of a management letter which deals with internal 
control weaknesses has become a standard service provided by an 
auditor to all audit clients. 


Implication: 
One could see some risk to independence where the auditor 
recommended, or designed and installed changes in the internal 
control systems, and subsequently these changes prove to be 
ineffective or actually create a problem or financial loss to the 
municipality. 


4. Interviewing for Professional Accounting and Financial Staff 
Since the auditor has considerable expertise in bookkeeping and 


accounting, it is not unusual for the municipal client, or any 
other client, to request the auditor’s assistance in the search 
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for, interviewing of, and training of bookkeeping and accounting 
staff. 


Implication: 

This might be where some conflict of interest may arise. Even 
though it is the municipality that actually makes the final 
decision, the auditor may have some reluctance in reporting to 
the client, when in the course of a subsequent audit, the person 
he recommended be hired has been identified as being incompetent 
or worse. 


Whether the interviewing process is carried on by a separate 
corporate management consulting arm of the auditing firm would 
not be relevant, particularly if the auditor actually does the 
interviewing. This would probably be the case since the client 
would want the interviewer to be very familiar with the 
operations of the municipality. 


5. Evaluating and Installing Computer Systems 


The auditor has considerable experience with the evaluation and 
installation of computer systems. Therefore it is not unusual for 
the municipality to request the auditor’s assistance for this 
purpose. Apart from computer systems in themselves, the auditor 
has considerable expertise with the design of the various reports 
which the computer systems would produce, and the appropriate 
internal controls to be considered. 


Implication: 

A conflict of interest may arise, and in all probability a 
perceived conflict will arise, where the auditor’s own firm or 
its related management consulting wing or separate firm is 
competing in the municipality with other management consulting 
firms or computer systems organizations. 
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6. General Consulting Services 


Because of the auditor’s breadth of experience in many business 
areas, and association with the management consulting wing of the 
auditor’s firm, general management consulting services are often 
provided. These services may extend beyond accounting or 
auditing matters and may involve other disciplines such as 
engineering. Included here would also be those services 
currently described as comprehensive auditing or value-for-money 
auditing. 


Implication: 

A conflict of interest may arise when subsequent audit findings 
bring the results of the consulting services into question. In 
addition, and as described above, there will probably be a 
conflict of interest where the municipality requests the auditor 
to review consultants’ proposals and the consulting wing of the 
auditor’s own firm is competing with other firms. 


7. Preparation of Annual Financial Statements 


The preparation by the auditor of the financial statements on 
which the auditor provides an opinion is the most widely raised 
issue when conflict of interest or loss of independence is 
discussed. 


The question is whether the municipal auditor can remain 
objective about these financial statements and whether the 
opinion in the auditor’s report is valid. Presumably the 
thinking is that, having prepared the financial statements, the 
auditor would overlook a misrepresentation or error in the 
financial statements which has been identified in the course of 
doing the audit. 
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Implication: 

Where the auditor prepares the financial statements, and in the 
course of the audit finds an error in the financial statements, 
there can be no motive or benefit in not making the correction. 
Even where the client had perhaps seen a copy of the statement in 
draft form, the auditor would still make the changes. The 
financial statements are prepared near the end of the audit 
process. The double (or more) checking and review of the 
statements and working papers within firms also provides an 
element of independence. 


Although it is the municipal treasurer’s responsibility to 
prepare the financial statements, usually the majority of 
municipalities do have their financial statements prepared by 
their auditors. In many municipalities the treasurer has a dual 
role - as clerk and treasurer and in many instances - the major 
part of his or her training is in the clerk’s’ function. 
Municipal auditors by virtue of training and experience are 
experts at preparing financial statements. They are also 
extremely knowledgeable about the reporting requirements for 
Ontario municipalities. Therefore it is both logical and 
economical to hire the auditor to actually prepare the financial 
statements. The same scenario occurs in the private sector. The 
vast majority of audit assignments include the preparation of 
financial statements. (This is not the case for the relatively 
few large audits for publicly traded corporations.) 


One argument is that if the municipal treasurer cannot prepare 
the financial statements, the municipality should hire a 
treasurer who can. Alternately the municipality should hire a 
second public accounting firm to prepare the statements on which 
the first firm will express an opinion. The obvious duplication 
of effort and fees should cause this argument to be dismissed 
very quickly. Also, the two-firm approach in the northern parts 
of the province is unworkable because of the distances between 
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municipalities and the firms auditing them, and the resulting 
travelling costs. 
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CHAPTER 4 AUDIT FEES 


This chapter identifies some of the factors that determine the 
level of audit fees and some of the criteria that can be used to 
evaluate the reasonableness of audit fees. These guidelines 
should however be applied carefully, since the quality of an 
audit is subjective and difficult to evaluate. A municipality 
should not try to emphasize low fees at the expense of quality. 
Another important aspect to any such ongoing service is the 
relationship between the auditor and the municipality. (See 
volume 1, of The Municipal Audit - Responsibility/Communication, 
chapter 5) 


Components of Audit Fees 


The audit process has many components. Audit firms charge fees 
according to a formula based on number of hours multiplied by 
staff charge-out rates, generally called per diem rates. 
Simplistically, they are selling their time based upon rates 
which reflect a certain level of expertise. The audit fee should 
not be the major criterion of an audit; however, many 
municipalities have been asking for proposals which may give 
average hourly rates, staff mix, estimated time, and out-of- 
pocket expenses. 


On the next page is a chart showing the various components of the 


audit and where municipal assistance could be used to save the 
auditor time and the municipality money. 
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Auditor Responsibility 


INTERIM AUDIT 

auditor objective: 
to examine, evaluate and test 
the system of internal control 


INTERIM AND YEAR-END AUDIT 


auditor requirements: 

planning to ensure: 
early liaison with client to 
map out audit strategy 
appropriate level and number 
of staff available 
suitable timing of audit 


extent of testing: 
emphasis on adequacy of internal 
control systems 


out-of-pocket expenses: 
use of client’s facilities 


Municipal Action Required 


40a 


implementation of auditor 
recommendations for improvements 
in internal control 


staff availability to assist 
audit staff in pulling and 
refiling documents 

have narrative and flow-chart 
descriptions of accounting 
systems available 

any internal audit staff work 
should be coordinated with 
external audit staff to avoid 
duplication of efforts 


the poorer the internal control 
systems, the more testing 
required by the auditor, 
therefore the more time, 
therefore the more money 


make facilities available and 
ensure working conditions are 
adequate 


Infrequent or Non-recurring Factors Affecting Audit Time 


Provision Of Ancillary Services 

Auditors are often requested to provide additional services which 
should be accounted for separately. The municipality should also 
be aware that the tendency to ask the auditor for advice on 
financial matters while he is on the premises for the year-end 
audit can be time-consuming enough to constitute an additional 
service. Time is money. Auditors also frequently provide 
extensive on-the-spot accounting training for municipal staff, 
which often goes unnoticed and is not easily separable. 


Audit Of New Computerized Accounting Systems 
In the first year of a new computerized (or manual) system, the 
auditor will have to: 

(a) test the old system in place for part of the year; 

(b) test the conversion to the new system; and 

(c) test the new system. 


This will take more time, and if the conversion did not go 
smoothly, the auditor may need to test an extremely large block 
of transactions. 


Changes In Reporting Requirements By The Ministry Of Municipal 
Affairs 


Occasionally there are major changes in reporting requirements 
requiring additional work on the part of the auditor. 


Special Purpose Audits 
Special purpose audits, including investigatory audits relating 


to irregularities, are usually subject to more _ intensive 
examination. This can often cost more than the audit of the 
entire municipality which is subject to testing transactions. 
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Assessing Audit Value 


In order to determine the audit cost to the municipality, it is 
necessary to have the fee segregated into the various components. 
It should be noted, however, that where an auditor both prepares 
and audits the financial statement, a clean split is difficult. 
For example, while the auditor is reconciling an account and 
preparing journal entries, he is also examining documents and 
following any other auditing steps appropriate to that account. 
Most other services, however, can be listed separately. 


When assessing the audit fee, the treasurer of the municipality 
can compare the fee with previous years and the estimates 
provided in the engagement letter, and analyse factors for 
significant changes. This should be done in consultation with 
the auditors so that explanations can be given. Audit fees 
should not be compared with other municipalities without taking 
numerous other factors into consideration. The size of the 
municipality is only one factor. Others are the sophistication 
of the accounting records available, the state of the 
municipality’s records, the size and number of local and joint 
boards and the state of the boards’ records, and the degree of 
assistance provided by municipal employees. 


Audit Fee Disputes 


Where the audit fee is in dispute, the treasurer should: 

(i) request a meeting with the auditor to discuss the 
dispute; 

(ii) analyse in detail the factors related to the audit 
fee submitted; 

(iii) request the auditor to provide a detailed time 
analysis report and discuss the reasonableness of 
the fee in the context of the time analysis data; 
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(iv) 


negotiate with the auditor a _— satisfactory 
settlement of the fee dispute if possible; and 

if a satisfactory agreement cannot be reached, 
consider contacting the Institute of Chartered 
Accountants of Ontario regarding the fees mediation 
service provided to auditors and their clients free 


of charge. 


Fees Mediation Services 


Before submitting a fees mediation request, both parties should 


be 


submissions should be sent to the Institute after such agreement 


in agreement on the use of the service and their written 


has been reached. 


The fees mediation service is only used in those circumstances 
where the auditor and the client cannot negotiate their own 


settlement. 


When disputes are brought to the attention of the Institute and 
when both parties agree in writing to be bound by the decision of 


the mediation panel: 


the Institute obtains as much information as it deems 


necessary from both parties; 


mediator meets with each party or with a representative 
authorized by either party, provided such representative 


shall not be legal counsel; 


the mediation panel reviews both the material submitted 
directly to the Institute and the facts gathered by the 


mediator; and 


the mediation panel’s decision as to an appropriate fee 
level is eventually confirmed to each party, in writing, 


with no reasons being given. 
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The submissions should contain the following: 


The Client 
a request that the Institute appoint a mediator or 
mediators to mediate the fee dispute, naming the member 
concerned; 
an outline of the problem, stating the services rendered 
and the amount of fee in dispute and the reasons for the 
objection; 
an undertaking to attend meetings with the mediator(s) 
when requested and that it is understood that neither 
party will be represented or accompanied by legal 
counsel at such meetings; and 
an undertaking to be bound by the decision of the fees 
mediation panel. 


The Member 
a request that the Institute appoint a mediator or 
mediators to mediate the fee dispute, naming the client 
concerned; 
an outline of the problem, stating services rendered, 
the amount of fee in dispute and the  member’s 
representation in support of the fee; 
an undertaking to make related working papers available 
to the mediator(s) and to disclose to the mediator(s) 
full particulars in support of the fee; 
an undertaking to attend meetings with the mediator(s) 
when requested and that it is understood that neither 
party will be represented nor accompanied by legal 
counsel at such meetings; and 
an undertaking to be bound by the decision of the fees 
mediation panel. 
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CHAPTER 5 THIRD PARTY LIABILITY 


Third party liability of an auditor relates to the legal 
liability of the auditor for a loss suffered by a person other 
than his own client due to negligent performance of his work. In 
a municipal context, a third party might include lenders, 
bondholders, general creditors, ratepayers, other municipalities 
and local boards outside the control of the _ particular 
municipality as well as employees and unions. It must be 
emphasized that the list is tentative, since the law as it 
applies to municipalities may be subject to wide interpretations. 


It is difficult to list the specific circumstances that could 
give rise to a third party action in the municipal sector, and 
whether the auditor or the municipality would be liable. 
Generally, they would be the same as in the private sector and 
involve misleading or misstated items in the audited financial 
statements. 


Needless to say, a municipality should provide for an adequate 
errors and omission liability insurance coverage. Below is an 
extract from Bulletin No.18 on Liability Protection published by 
this Ministry. 


AVAILABILITY OF ERRORS AND OMISSIONS LIABILITY 
INSURANCE 


Errors and omissions liability insurance used to be 
available only to members of a _ recognized 
professional association, such as_ those _ for 
engineers, lawyers and physicians. Recently, with 
the increasing actions or threatened actions against 
employees and members personally, as well as _ the 
municipality or local board, the need for this 
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coverage became apparent. The misinterpretation of 
zoning by-laws, inadequate instructions to 
developers, or improper building inspections are some 
of the portential causes of action against the 
employee or the member. 


Third party liability presumably would fall under this coverage. 


A more indepth discussion has been provided in Appendix B. 
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APPENDIX A 


FEATURES FOR A GOOD INTERNAL CONTROL SYSTEM 


ORGANIZATION OF MUNICIPAL PERSONNEL 


A plan of organization. A written formal plan of 
organization should include a description of areas of 
responsibility and job functions. 


Competence and training of employees. Employment 
policies should reflect an emphasis upon employee 
competence and duties assigned should be commensurate 
with the capabilities of the personnel. Continued 
training should be a part of the program. 


Honesty. The background of prospective employees 
should be investigated to determine honesty and 
integrity. 


Bonding. Employees should be bonded to insure against 
embezzlement losses. 


Supervision. Employees should be properly supervised 
to ensure that duties are being carried out as 
assigned. 


Fixing responsibility. If responsibility is fixed, 
the failure to discharge duties adequately can be 
easily traced. The control factors also establish an 
accountability for losses due to inefficiency or 


fraud. 
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a) 


b) 


c) 


Division of duties. 


No one _in complete control. No one person should be 
in control of an entire transaction. Such complete 


control would permit the employee to _ operate 
inefficiently, or fraudulently without detection. 


Separate custodianship. The individual in charge of 
recording or maintaining accounting control over 
assets should not have physical access to or custody 
of those assets. , 


A_system of double check. Duties should be so 
divided that one person checks on the accuracy of the 


work of another person such as the reconciling of the 
taxes receivable subledger with the general ledger. 


Performance standards. Establishment of performance 
standards and periodic comparison and monitoring of 
actual performance against those standards should be 
developed. 


Authorizations. The procedures should provide for a 
system of authorization at various levels to prevent 
unauthorized actions. linGeeahact) =  Lhatemathe 
authorization may be lacking in a given circumstance 
would call for immediate investigation. 


Internal auditing. Many large municipalities employ 
internal auditors whose function is to audit detailed 
transactions, review the accounting and operational 
procedures and determine the adequacy of the internal 
control system and the extent of compliance with 
municipal policies. 
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Independent examination. The possibility of 
examination by the independent public accountant is, 
in itself, an important control feature. 


B. SYSTEM OF PROCEDURES, RECORDS AND RECORDKEEPING 
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a) 


Written manuals. The accounting and operational 
procedures should be set forth in accounting and 
procedures manuals so that the policies and 
instructions may be explicitly known and uniformly 
applied. The existence of a chart of accounts, for 
example, will aid in the application of accounting 
policies, in the proper recording of transactions and 
facilitate the preparation of financial statements. 


Budget to actual comparison. Operating and capital 
budgets should be maintained and a periodic review of 
actual results compared to budgeted projections and 
follow-up investigation of significant variances 
should be undertaken. 


Internal reporting. Formalized internal reporting 
system should be set up requiring the preparation of 
financial reports and statements on a daily, weekly, 
monthly, quarterly and annual basis. 


Accounting controls. 

Maintaining a general ledger, chart of accounts and 
taking of trial balances on a regular basis are 
internal control features that: 

i) assist in ensuring transactions are recorded in 


a timely and orderly manner in one central 


document; 
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b) 


Cc) 


d) 


ii) aid in detecting errors or discrepancies if the 
trial balance does not balance (i.e. credits do 
not equal debits); 


iii) serve as a primary documentary reference source 
for investigating problems or errors in that al] 
postings to the general ledger have been 
obtained from books of original entry; and 


iv) aid in maintaining the integrity of _ the 
management information system. 


Maintaining journals, subledgers and other posting 
documents provides support for the postings by 
detailing the underlying documentation and 
transactions involved. In addition, these related 
books-of-account ensure the division of duties 
amongst staff in that, if at all possible, the 
custodian of the general ledger should not be 
responsible for, or be involved in maintaining these 
other accounting records. 


Balancing and reconciliation procedures are internal 
control elements in that they detect errors or 
discrepancies that require investigation and 
solution. 


Cut-off routines are those which relate to ensuring 
transactions are recorded in the accounting records 
in the appropriate time or reporting period. This is 
extremely important | at year-end when a precise 
determination has to be made as to what transactions 
should be included in the year’s’ financial 
statements. A misallocation of amounts could result 
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a) 


b) 


in a significant over-/ or under-statement which 
could impair year-to-year comparisons. 


Validation stamps should be used to ensure all the 
necessary procedures and authorizations have been 
performed and duly noted, if Jater on-— an 
investigation has to be conducted into an error or 
irregularity. 


Forms and documentation. 


Use standardized forms and documents to promote 
uniformity of accounting records. 


Use pre-numbered documents to control the numerical 
continuity of documents and consequently be able to 
follow up missing forms where the numerical sequence 
is not maintained. 


Restricted access. Restrict access to confidential 
and important records and unused document forms as 
well as to assets such as cash or other negotiable 
assets. Restricted access is important to make 
certain only authorized personnel have physical 
access to the accounting records or assets. In this 
way responsibility can be clearly assigned to an 
individual to ensure adherence to correct and proper 


procedures. 


Signing authority. Signing authority procedures 
should be employed to serve as a record as to what 
was approved, reviewed or authorized by whom. For 
example, cheque-signing authorization is an important 
internal control over the issuance of cheques. 
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Periodic counts. Periodic counts should be conducted 
and results compared to the related accounting 
records; such as, for example, counting and comparing 
petty cash on hand to the petty cash balance recorded 
in the general ledger. 


Frequent reconciliations. Make frequent 
reconciliation of subsidiary accounts to general 
ledger control accounts; for example, compare total 
of individual tax arrears amounts to the total in the 
general ledger account. ; 


Publicity. If the internal control policies and 
procedures are publicized, deviation from approved 
practice may be discouraged or detected. 


Authorization. Transactions should be properly 
authorized by appropriate personnel. 


C. AUTOMATIC AND MECHANICAL SAFEGUARDS 
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24. 


a) 


b) 


Adequate insurance. The municipality should be 
adequately insured against fire and legal 
liabilities. 


Custody devices. 


Protection of records in locked filing cabinets and 
vaults serves as an internal control feature over 
fire, theft or unauthorized use. 


Use of equipment such as cheque-signing protectograph 
machines, bookkeeping machines and cash registers 
also serve as internal control devices to prevent 
easy alteration or manipulation of amounts. 
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Correspondence log. Record all correspondence 
received in a log book on a daily basis. 
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APPENDIX B 


CONTINUED DISCUSSION OF THIRD PARTY LIABILITY 


The law in this respect has undergone a significant change. The 
old rule held that only a client could recover because the 
liability could arise only out of a breach of a contractual 
relationship between a defendant and client. Until recently, 
this "privity of contract" principle was absolute in barring a 
third party from recovery. The equity of completely 
disregarding third party rights had been questioned increasingly 
over the years and in 1963, a landmark court decision in the 
United Kingdom, the Hedley Byrne v Heller case seemed to launch a 
new day for a third party by extending the liability beyond the 
bounds of contractual relationships. 


Common law 


The law created by a decision of the judges rather than the 
statute or codified law established by legislative bodies is 
known aS common or case law. A previous law as re-interpreted 
then sets a precedent in how the lower courts apply it in 
subsequent cases. The courts, in adapting the existing legal 
principles, are acknowledging the changes in customs and 
conventions that have taken place in society and reflecting them 
in law to suit new realities and circumstances. 


Law of tort 


The legal responsibilities of an auditor fall under the three 
categories of statute, contract and tort. If an auditor fails to 
meet any of these legal responsibilities he may become legally 
liable. Tort is a civil wrongdoing as opposed to a criminal 
wrongdoing and is independent of contract. The courts will 
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redress for the injury or harm caused as a consequence of anyone 
who, while doing anything at all, fails in his duty to do so with 
proper care. 


Law of negligence 


The law of negligence governs such tort suits. Most actions 
brought against an auditor by a third party fall under the law of 
negligence as a result of the auditor failing to perform a legal 
duty or failing to perform that duty with the requisite standard 
of care. In law there can be no negligence until there exists a 
legal duty to take care. 


The law will impose a duty of care wherever the circumstances of 
One person’s relationship to another are such that, first, the 
person’s actions or omissions could reasonably be expected to 
cause injury to that other person or his property. The second 
element in an action of negligence is a failure to conform to the 
standard of care that the law requires. The third essential 
element of negligence is proof that the plaintiff has suffered 
damage. The fourth is a reasonable cause and effect connection 
between the breach of duty and the resulting damage. 


The plaintiff must establish adequate proof of all four elements 
to succeed. For instance, if an investor suffered losses but 
never read the particular financial statements, nor placed any 
reliance on them, the litigation may fail. 


The courts have developed the "foreseeability test" requiring a 
person to take due care to avoid acts or omissions which he can 
reasonably foresee and which would likely injure a neighbour. 
For an auditor this generally means that he is held liable for 
negligence to a limited class of third parties who, relying on 
his negligent report, undertakes a commitment and suffers a 
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financial loss. However, he is not responsible to "an 
indeterminate class" of third parties. 


Legal duty of care 


The legal duty of care is based on the principle that anyone 
holding himself out to the public as possessing the degree of 
skill commonly possessed by others in the same employment must 
perform his work with the standard of care and skill identified 
with the group. A public accountant must perform his work with 
the care and skill which a reasonably competent, careful and 
cautious auditor would use. The standard by which the auditor’s 
work is judged is not the highest of the auditors, nor the 
lowest but that of "a reasonable man." 


In determining the standard of legal duty of care of an auditor, 
the courts have generally referred to the profession’s Rules of 
Conduct and the generally accepted auditing standards required of 
members in the provincial professional body of _ public 
accountants. The topic was discussed earlier in chapter 1 of 
"The Municipal Audit - Responsibility/Communication." Courts may 
apply a higher level of care since legal concept is influenced 
both by legislative provisions and by past decisions in the 
courts. Also, specific terms in a contractual agreement may call 
for a higher standard of care. 


Turning points 

The first important doubt cast on the equity of the privity of 
contract concept came in 1951 in an English case.! A defendant 
auditor was found innocent on the privity of contract rule but 
one of the judges observed that "the law would fail to serve the 


best interests of the community if it should hold that 


ICandler v Crane, Christmas & Co. (1951) 2 KB 164. 
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accountants and auditors owe a duty to no one but their 
client.... If such be the law, I think it is to be regretted, for 
it means that the accountant’s certificate, which should be a 
safeguard, becomes a snare for those who rely on it." 


In the historic 1963 case, the House of Lords enunciated 
doctrines which rejected the defence of absence of the privity of 
contract. It stated that persons should be held liable for 
negligent misrepresentations to third parties, even though 
unidentified at the time, whose reliance on their statements 
could be reasonably foreseen. The Law Lords qualified the last 
statement by recognizing that there must be some limits in 
extending liability to unknown third parties; otherwise, as 
earlier stated by a prominent U.S. judge, it would "... expose 
accountants to a liability in an indeterminate amount for an 
indeterminate time to an indeterminate class." 


The Hedley Byrne case has had a profound effect on auditors 
throughout the countries of English common law roots with the 
decision in one country impacting on others. It has radically 
widened auditors’ legal responsibilities and initiated a new base 
for actions against the auditors. In the past few years a sharp 
increase in general litigations and out-of-court settlements in 
the United States, Great Britain and Australia has been reported. 
No figures, official or otherwise, are available for Canada. 


There is a popular perception that this recent surge is directly 
linked with the application of the Hedley Byrne principles. 
However, on analysis, it appears that a major portion is 
attripuctabler to fraud actions (in “contrast ‘Lo ithird party 
actions), the propensity in the United States of the lawyers 
accepting these actions on a contingency fee basis and a delayed 
decision in a major fraud case involving a large U.S. auditing 
firm. The "deep pocket" syndrome, which is explained later, has 
been a significant contributor to the total. Certainly, it is 
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odd that this increase is taking place almost two decades after 
the historic decision. 


Here in Canada, the doctrine has been applied against an auditor 
once by the Supreme Court in the Haig v Bamford case in 1976. 
Our highest court seems reluctant to widen the Hedley Byrne 
principles with respect to auditors. The lower courts, whose 
decisions are reported prominently in the journals, reflect the 
same approach. 


The controversy over third party rights has been simmering for 
nearly a century, and it still continues despite the important 
precedent. One conclusion seems apparent; the courts throughout 
the common law countries have not set aside the privity rule in 
the way one might have thought after reading the legal accounts 
at the time. sihevstrengin cof the privity erulesnasmaverted ste 
kind of increased court awards the auditors feared.@ 


Also, it should be remembered that a court’s decision may be 
determined on a legal point which overrides the suit. It is 
important to bear in mind that in a third party action - and, 
therefore, involving negligence - the litigant must prove 
successfully all of the four prerequisite elements referred to 
earlier. A number of cases have failed on this fundamental 
point. 


Furthermore, the courts have had considerable difficulty with 
third party liability cases involving auditors since each must 
relate to the particular statutory and case law of their 
jurisdiction which can vary importantly from one country to 


2students of law are directed to a Privy Council case which 
came after the Hedley Byrne case and specifically limited the 
scope of the doctrine outlined in Hedley Byrne, the Mutual Life 
Assurance v Evatt (1971) AC 793. As the case was decided by the 
Privy Council, it did not have binding authority but has managed 
to carry persuasive influence in mitigating the doctrine. 
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another, and on the surrounding circumstances of each case. The 
problem is complicated by such factors as: two different legal 
interpretations existing at one time; whether the statements are 
unaudited or audited; how quickly and responsibly the plaintiff 
acted to minimize the damage; whether a disclaimer of opinion 
has been issued; whether the judgment and the awards are 
consistent; and whether a decision has been upheld or overturned 
by a higher court. As a result it is often extremely difficult 
to state exactly what the law is on a particular issue. 


Concerns of the auditor 


The extension to third parties of the action for negligence has 
serious implications for the auditor. If an auditor is found 
guilty in a third party action for negligence and his resources 
and insurance are insufficient, he may be placed in grave 
financial difficulty, possibly losing all his personal assets. 


The problem has been compounded by the reduced insurance coverage 
and the recent sharp rise in insurance premiums as a result of 
the increased legal damages awarded to third parties. As a 
result, most Canadian accounting firms, at least the small- and 
medium-sized ones, rely on the Canadian Institute of Chartered 
Accountants endorsed insurance program. It is estimated that a 
good number of them require a larger coverage than the maximum 
coverage of $2 million which was increased in 1987 from $1 
million. This program basically covers negligent act, error or 
omission, and breach of contract or duty. 


The large international firms have arranged their insurance 
through a broker who deals with them on an international basis. 
In the past few years, some firms with coverage as high as $250 
million have had it reduced to $50 million for which the premium 
is four times as much. It is the insurance above the self- 
insured layer that poses the greatest problem. There simply is 
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no market prepared to write reinsurance for accountants at such 
catastrophic levels. 


Thus, the reduced coverage is more of a problem than the 
increased cost, since the very livelihood of an accounting firm 
may be in danger should the damage claim exceed the insurance 
coverage. To overcome this problem, the profession is advancing 
a number of legal amendment proposals which would have the effect 
of limiting the amount of a claim. One proposal is to place a 
statutory cap on the losses arising from liability claims; 
another is to allow auditors to incorporate themselves or “to 
allow a limited partnership. 


The accountants, along with other professions, are lobbying to 
have The Negligence Act amended so that the joint and several 
liability aspect of the law is eliminated and replaced by joint 
liability. Joint and several liability is a legal term applied 
to an obligation that allows a creditor to collect from one 
liable party separately or from all liable parties together, 
whereas several liability is an obligation that is separate and 
distinct from the liability of another. The proposal would 
prevent a plaintiff collecting from one member, or from all of 
them together until the liability is satisfied, irrespective of 
the proportionate blame in the action. This is known as the 
"deep pocket" syndrome where a minor party such as an auditor may 
become liable for a major portion of an award. 


Implications 
The. possibility, of a ‘third) party), saction“s.againsty the 


municipality’s auditor should cause municipalities to look more 
carefully at the needs and rights of their own third parties. 
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COMMENTS 


Your comments on this publication are encouraged. If you would 
like to give us your thoughts, just fill in and cut out the form 
at the bottom of this page and return it to: 


Director 

Municipal Management Practices Branch 
Ministry of Municipal Affairs 

llth Floor, 777 Bay Street 


Toronto, Ontario 
M5G 2E5 


COMMENTS 
THE MUNICIPAL AUDIT: OTHER RESPONSIBILITIES 


Did you find this publication: 


useful yes no 
timely yes no 
easy to yes no 
understand 


Other Comments, including suggestions for future publication 
subjects. 
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BULLETIN SERIES 


Following is a list of available publications: 


Administration: 


Records-Retention By-laws 
By-law Enforcement - An Administrative View 
The Municipal Conflict of Interest Act, 1983 
Keeping the Public Informed 
Affirmative Action 
Municipal Tendering - Common Practices 
The Municipal Tax Sales Act 
* By-Law Indexing 
* Small Business Incubators 


* Pay Equity Act 


* Also available in French 
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MANAGEMENT ADVISORY PUBLICATIONS (MAP) 


Joint Services--Five Case Studies, April, 1983 
Municipal Councillor's Manual, January, 1986 
When and How to Use Consultants, August, 1986 


#1. The Municipal Audit: Communications/Responsibilities, 
November, 1986 


Understanding Your Financial Statements, June 1987 


#2. The Municipal Audit: Other Responsibilities 
February, 1988 


Avoiding Wrongful Dismissal, 
February, 1988 


Also available in French 
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Financial Procedures: 
eee Cash Management in Municipalities ($1) 
Eee Bank Reconciliation Procedures for Municipalities ($1) 
ee} Municipal Investments ($1) 
F.4 Zero-Base Budgeting ($1) 
Fad Reserves, Reserve Funds, Allowances and Other Special Funds ($1) 
E65 Property Taxation--Billing and Collection ($1) 
Je ey Calendarized Budgets ($1) 
uae peice Fixed Asset Record Keeping ($1) 


Financial Publications 


Financial Disclosure to the Public--A Code for 
Municipalities in Ontario ($2) 


Municipal Financial Reporting Handbook ($15) 
Basic Accounting Package "BACPAC" ($15) 


Prices subject to change without notice 


Additional copies of this and other Ontario Government publications are 
available from: 


The Ontario Government Bookstore, 880 Bay St., Toronto for personal 
shopping. Out-of-town customers write to Publications Services Section, 
5th Floor, 880 Bay St., Toronto M7A 1N8. Telephone (416) 965-6015. Toll 
free long distance 1-800-268-7540, in area code 807 dial 0O-Zenith 67200. 
Hearing impaired call: (416) 965-5130 or toll-free 1-800-268-7095. 
Mastercard and Visa accepted. Cheques and money orders payable to the 
Treasurer of Ontario. Prepayment required. 


* Also Available in French 
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For more information, write or call any of the field 
offices of the Municipal Operations Division. They are 
located at these addresses. 


CAMBRIDGE OSHAWA 
150 Main Street 74 Simcoe St. S. 
Cambridge (Ontario) Oshawa (Ontario) 
NIR 6P9 L1H 4G6 
(519) 622-1500 (416) 571-1515 
GUELPH KINGSTON 
147 Wyndham St. N. 1055 Princess Sti 
Guelph (Ontario) Kingston (Ontario) 
N1H 4E9 Kile ols 
(519) 836-2531 (613) 545-4310 
LONDON OTTAWA 
495 Richmond St. 244 Rideau St. 
London (Ontario) Ottawa (Ontario) 
N6A 5A9 KING 5Y3 
(519) 438-7255 (613) 566-3711 
NORTH BAY SUDBURY 
126 Lakeshore Dr. 430 Notre-Dame Avenue 
North Bay (Ontario) 2nd Floor 
PIA 2A8 Sudbury (Ontario) 
(705) 476-4300 P3G 5K? 
(705) 675-4343 
ORILLIA 
15B Matchedash St. N. THUNDER BAY 
Orillia (Ontario) 435 James St. S. 
L3V 474 CPs 5000 
(705) 325-6144 Thunder Bay (Ontario) 
P7C 5G6 
TORONTO (807) 475-1621 
ithe Loor 


777 Bay Street 
Toronto (Ontario) 
M5G 2E5 

(416) 585-7205 


Any questions or comments regarding the contents of this 
publication may be addressed to the Ministry at the above Toronto 
address and telephone number. 
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